Type the following command to copy the pkcs12 file to the /opt/qradar/conf/key_certificates directory:

Transcription

1 Event and flow retention 89 Step 5 Step 6 Step 7 Step 8 Type the following command to copy the pkcs12 file to the /opt/qradar/conf/key_certificates directory: cp <pkcs12_filename.pkcs12> /opt/qradar/conf/key_certificates Create a client on the IF-MAP server with the Certificate authentication and upload the SSL certificate. For assistance, contact your IF-MAP server administrator. Change the permissions of the directory by typing the following commands: chmod 755 /opt/qradar/conf/trusted_certificates chmod 644 /opt/qradar/conf/trusted_certificates/*.cert Type the following command to restart the Tomcat service: service tomcat restart Event and flow retention About retention buckets Using the Event Retention and Flow Retention windows available on the Admin tab, you can configure custom retention periods for specific events and flows. Each retention bucket defines a retention policy for events and flows that match custom filter requirements. As QRadar SIEM receives events and flows, each event and flow is compared against retention bucket filter criteria. When an event or flow matches a retention bucket filter, it is stored in that retention bucket until the retention policy time period is reached. This feature enables you to configure multiple retention buckets. Retention buckets are sequenced in priority order from the top row to the bottom row on the Event Retention and Flow Retention windows. A record is stored in the bucket that matches the filter criteria with highest priority. If the record does not match any of your configured retention buckets, the record is stored in the default retention bucket, which is always located below the list of configurable retention buckets. Configuring retention buckets By default, the Event Retention and Flow Retention windows provide a default retention bucket and 10 unconfigured retention buckets. Until you configure a retention bucket, all events or flows are stored in the default retention bucket. The Event Retention and Flow Retention windows provide the following information for each retention bucket: Table 5-6 Retention window parameters Order Name Retention Compression Specifies the priority order of the retention buckets. Specifies the name of the retention bucket. Specifies the retention period of the retention bucket. Specifies the compression policy of the retention bucket.

2 90 SETTING UP QRADAR SIEM Table 5-6 Retention window parameters (continued) Deletion Policy Filters Distribution Enabled Creation Date Modification Date Specifies the deletion policy of the retention bucket. Specifies the filters applied to the retention bucket. Move your mouse pointer over the Filters parameter for more information on the applied filters. Specifies the retention bucket usage as a percentage of total event or flow retention in all your retention buckets. Specifies whether the retention bucket is enabled (true) or disabled (false). The default setting is true. Specifies the date and time the retention bucket was created. Specifies the date and time the retention bucket was last modified. The Event Retention and Flow Retention toolbars provide the following functions: Table 5-7 Retention window toolbar Function Edit Enable/Disable Delete Click Edit to edit a retention bucket. For more information on editing a retention bucket, see Editing a retention bucket. Click Enable/Disable to enable or disable a retention bucket. For more information on enabling and disabling retention buckets, see Enabling and Disabling a Retention Bucket. Click Delete to delete a retention bucket. For more information on deleting retention buckets, see Deleting a Retention Bucket. Double-click the first available retention bucket.

3 Event and flow retention 91 Step 5 Configure the following parameters: Name Keep data placed in this bucket for Allow data in this bucket to be compressed Delete data in this bucket Current Filters Type a unique name for the retention bucket. From the list box, select a retention period. When the retention period is reached, events or flows are deleted according to the Delete data in this bucket parameter. The default setting is 1 month. The minimum is 1 day and the maximum is 2 years. Select the check box to enable data compression, and then select a time frame from the list box. When the time frame is reached, all events or flows in the retention bucket are eligible to be compressed. This increases system performance by guaranteeing that no data is compressed within the specified time period. Compression only occurs when used disk space reaches 83% for payloads and 85% for records. The default setting is 1 week. The minimum is Never and the maximum is 2 weeks. From the list box, select a deletion policy. Options include: When storage space is required - Select this option if you want events or flows that match the Keep data placed in this bucket for parameter to remain in storage until the disk monitoring system detects that storage is required. If used disk space reaches 85% for records and 83% for payloads, data will be deleted. Deletion continues until the used disk space reaches 82% for records and 81% for payloads. When storage is required, only events or flows that match the Keep data placed in this bucket for parameter are deleted. Immediately after the retention period has expired - Select this option if you want events to be deleted immediately on matching the Keep data placed in this bucket for parameter. The events or flows are deleted at the next scheduled disk maintenance process, regardless of free disk space or compression requirements. Type a description for the retention bucket. This field is optional. In the Current Filters pane, configure your filters. To add a filter: 1 From the first list box, select a parameter you want to filter for. For example, Device, Source Port, or Event Name. 2 From the second list box, select the modifier you want to use for the filter. The list of modifiers depends on the attribute selected in the first list. 3 In the text field, type specific information related to your filter. 4 Click Add Filter. The filters are displayed in the Current Filters text box. You can select a filter and click Remove Filter to remove a filter from the Current Filter text box.

4 92 SETTING UP QRADAR SIEM Step 6 Step 7 Click Save. Your event or flow retention bucket configuration is saved. Click Save. Your event or flow retention bucket starts storing events or flows that match the retention parameters immediately. Managing retention bucket sequence You can change the order of the retention buckets to ensure that events and flows are being matched against the retention buckets in the order that matches your requirements. Retention buckets are sequenced in priority order from the top row to the bottom row on the Event Retention and Flow Retention windows. A record is stored in the first retention bucket that matches the record parameters. You cannot move the default retention bucket. It always resides at the bottom of the list. Editing a retention bucket Select the retention bucket you want to move, and then click one of the following icons: Up - Click this icon to move the selected retention bucket up one row in priority sequence. Down - Click this icon to move the selected retention bucket down one row in priority sequence. Top - Click this icon to move the selected retention bucket to the top of the priority sequence. Bottom - Click this icon to move the selected retention bucket to the bottom of the priority sequence. If required, you can edit the parameters of a retention bucket. On the Retention s window, the Current Filters pane is not displayed when editing a default retention bucket.

5 Event and flow retention 93 Select the retention bucket you want to edit, and then click Edit. Step 5 Edit the parameters. For more information on Table 5-6. Step 6 Click Save. Enabling and Disabling a Retention Bucket Deleting a Retention Bucket When you configure and save a retention bucket, it is enabled by default. You can disable a bucket to tune your event or flow retention. When you disable a bucket, any new events or flows that match the requirements for the disabled bucket are stored in the next bucket that matches the event or flow properties. Select the retention bucket you want to disable, and then click Enable/Disable. When you delete a retention bucket, the events or flows contained in the retention bucket are not removed from the system, only the criteria defining the bucket is deleted. All events or flows are maintained in storage. Select the retention bucket you want to delete, and then click Delete.